1. Field of the Invention
The present invention relates both to a process and a test circuit for verifying proper operation of a system fault monitor, and more particularly to a method and test circuit in which the monitor is connected with the system when actual system signals are produced, and is connected to receive signals corresponding to erroneous system signals for monitor verification during those times no actual system signals are produced.
2. Description of the Prior Art
System fault monitors are commonly used in a variety of electrical systems where it is essential to alert the system operator of a malfunction, so that appropriate measures can be taken by the operator.
An important example arises in the context of a microwave landing system (MLS). Basically, a MLS employs an azimuth (AZ) phased array antenna which scans its radiated beam "to" and "fro" periodically in the horizontal direction, and an elevation (EL) phased array antenna which scans its beam up and down periodically in the vertical direction. Equipment on board an aircraft approaching a runway equipped with a MLS, counts the time period between reception of the beam from the AZ antenna on its "to" scan and reception of the beam on the "fro" scan. The counted time difference corresponds to a unique azimuth heading of the aircraft relative to the AZ antenna. By a corresponding time-difference counting operation with respect to the scanning beam from the EL antenna, the aircraft equipment determines a unique elevation angle for the craft relative to the EL antenna. Since both the AZ and EL antennas are located adjacent the runway employing the MLS, the pilot thus receives information which is critical in determining a proper glide path for a safe landing on the runway.
It will be appreciated that precise timing of the scanning operation of both the AZ and EL antennas is essential in order to provide accurate glide path information to the aircraft pilot. Any system malfunction resulting in a deviation of the timing of the scanning beams from either the AZ or the EL antennas from a predetermined time sequence, will cause the onboard equipment to produce erroneous heading information.
Radio frequency (RF) probes serve as monitors in a MLS, by (a) detecting the strength of the wave energy radiated from the AZ and EL antennas at different points in space while the beams scan "to and fro" and "up and down", and (b) determining the detected energy levels lie within predetermined limits. Through the use of a number of RF probes or monitors at appropriate locations relative to the MLS antennas, it can be established whether or not the instantaneous scan angle of the radiated beams, and the effective radiated power of the main lobe and side lobes of each beam, meet system specifications. If not, the entire system must be shut down after a fault condition exists for a certain time to avoid erroneous heading information to develop on board an approaching aircraft. That is, false guidance to the aircraft presents a worse situation than no guidance at all since, in the latter case, the pilot may resort to other available instrument approach systems, land entirely visually if possible, or abort the landing and continue to another runway with properly operating facilities.
The system monitors employed in a MLS are typically analog to digital devices and are themselves subject to erroneous operation due to component failure, circuit board fracture, cable/connector breakage and the like. Therefore, in order to ensure that the system monitors are themselves working properly, a monitor verification routine is carried out periodically, usually at times during which the monitor being verified is not called upon to detect an active scanning beam of the MLS. For example, a monitor positioned to detect a scanning EL beam does not produce useful data during the scan period of the AZ beam, and vice versa.
Basically, monitor verification calls for the purposeful injection of false signals into selected monitors while the monitor output signals are observed by a controlling computer or processor. While the false data is injected, the selected monitor output should indicate the presence of erroneous input data. On-line monitors are generally combined with counters, time delay or other filter means so that an output indicative of an erroneous input to the monitor is produced only if the error signal is input to the monitor over a predetermined time (e.g., 0.8 seconds). Such filtering of error data thus reduces the number of false alarms from a given monitor to a minimum.
A problem in monitor verification with monitors employing such filter means arises, however, in that the false error signals must persist at the monitor input for a time greater than the filter delay time to allow the controlling processor to determine if the selected monitor has detected an error. That is, in order to test the monitor properly, it must be taken "off line" for at the least the filter delay time. A continuous off line time of 0.8 secs. is not tolerable in a MLS system for some of the system monitors which must be actively connected on-line within shorter time periods.
A known arrangement which overcomes the problem of taking a given monitor off-line for an extended time to verify proper monitor operation in a MLS involves implementing a change in the monitor filter delay value. This change is accomplished by the controlling processor prior to a verification operation, so that when only one more false error signal is input to the monitor the filter time value is exceeded and the monitor should indicate such error at its output if working properly. Although such changing of the monitor filter parameters overcomes the problem of taking the monitor off-line for an intolerable period of time, another problem arises in that the filter circuits themselves cannot be tested simultaneously with the monitor for proper operation.